Kosovar Operator Kutleshi Pleads Guilty to Running Rydox Marketplace with 321k Listings

Court records show Rydox.cc was seized in December 2024 alongside servers and $225,000 in cryptocurrency. The platform enabled trading of stolen PII, payment cards, credentials, phishing kits, and stealer logs among roughly 18,000 users. Kutleshi faces a mandatory two-year term plus up to 20 years on the laundering count, with sentencing set for February 2027. Extradition from Kosovo followed arrests of two associates, Jetmir Kutleshi and Shpend Sokoli.

The case reveals patterns in Balkan-based marketplaces that mirror earlier takedowns like DarkMarket and Genesis Market, where operators relied on cryptocurrency revenue streams averaging $232,000 here. Procurement and seizure data indicate sustained US-Kosovo cooperation on domain and financial tracing, yet independent verification of user-base claims remains limited to the single seized domain. Revenue figures appear low relative to listing volume, suggesting unreported off-platform payments.

Official attribution focuses on Kutleshi as sole administrator, but technical evidence from server seizures could expose additional infrastructure hosted in third countries. This operation aligns with documented increases in identity-theft tooling sold on clearnet-adjacent forums, amplifying downstream fraud against US financial systems. Next steps likely include further indictments tied to the same infrastructure logs.